All Apps and Add-ons

fire brigade errors

a212830
Champion

Hi,

I have the latest fire brigade installed on a 6.4.1 SHC (and the appropriate TA on the indexers). I'm getting the following errors from "cumulatize usage over all hosts panel" in the the cross-host index overview page.

[subsearch]: Failed to fetch REST endpoint uri=https://127.0.0.1:8089/services/data/indexes/dh_clocksync?count=0&search=disabled%3D0 from server=https://127.0.0.1:8089
[subsearch]: Unexpected status for to fetch REST endpoint uri=https://127.0.0.1:8089/services/data/indexes/dh_clocksync?count=0&search=disabled%3D0 from server=https://127.0.0.1:8089 - Not Found

0 Karma

sowings
Splunk Employee
Splunk Employee

I'll put good money on the fact that the "dh_clocksync" index doesn't exist on your search head(s).

0 Karma

sowings
Splunk Employee
Splunk Employee

To elaborate on my answer a bit more: Those pages will attempt a REST query to find out about the configured retention limits for the index. The purpose is to be able to report "% of capacity" as compared to current usage. The SH will attempt to do this across all hosts, including itself. If the index definition for dh_clocksync only exists on the indexers, the SH (127.0.0.1) will report the error you see.

You might consider the Troubleshooting menu, the "Troubleshooting Index Configuration" to see which host(s) don't have that index.

0 Karma

sloshburch
Ultra Champion

What answer/insight are you looking for? I ask because it might be available in the DMC now (and if not, we can let the DMC team know). I have DMC bias...

Psst: I think you mean Fire Brigade, not Fire Bridge.

0 Karma

sowings
Splunk Employee
Splunk Employee

Oh Burch, why no love?!

0 Karma

sloshburch
Ultra Champion

😉 I figured if I was disparaging enough it would be like a Bat-Signal and get you running 😉

0 Karma

a212830
Champion

That's part of what I'm trying to determine - do I need fire brigade.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Cisco Data Fabric from Architecture to Investigation, Better SOC Visibility, and More ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

The Trust Gap: Why a Data Foundation is Fundamental to an Agentic Enterprise

The Trust Gap: Why a data foundation is fundamental to an  Agentic Enterprise.   Agentic AI is transforming ...

Data Management Digest – September 2026

    Welcome to the September 2026 edition of Data Management Digest! September brought a fresh wave of ...